Performance Suggestion with MS A/V scanning for Julian

[Jay Chandler]

TCIS List Acct wrote:
> Hi Julian,
>
> Here is a thought --
>
> When using multiple A/V scanners from within MS, would it be possible to:
>
> 1. Specify the order in which the A/V scanners are tried (this may 
> already be the behavior based on order in the config, not sure).  The 
> rationale for this is that some scanners are faster than others (e.g. 
> f-prot is faster than clamav).
>
> and, if
>
> 2. The first A/V scanner finds a virus, to not try any subsequent A/V 
> scanners.  The reason for this is, 99.9% of today's viruses are 
> removed rather than cleaned, so if the attached infected file is 
> getting removed anyway, what point is there to wasting resources in 
> passing the infected file to subsequent A/V scanners?
>

 This has been suggested before, IIRC.  The reasoning was it took more 
resources to strip the message out and recombine the batch than it did 
to simply keep going.  Remember, MS works on a "batch of emails" 
principle, not the individual files themselves.

-- 
Jay Chandler
Network Administrator, Chapman University
714.628.7249 / chandler at chapman.edu
Today's Excuse: Party-bug in the Aloha protocol.